external-dns.alpha.kubernetes.io/exclude: "true" is honored by k8s-gateway as well as external-dns; adding it blocked cluster-internal DNS from publishing coder.renner.uno.
Cloudflare external-dns filters on the cloudflare-proxied annotation, which this Ingress doesn't have — so dropping exclude is sufficient to keep the record off Cloudflare while letting k8s-gateway publish it internally.
Test plan
kubectl run curltest --image=curlimages/curl -- curl -sk -o /dev/null -w '%{http_code}' https://coder.renner.uno/api/v2/buildinfo returns 200 from inside the cluster
## Summary
- `external-dns.alpha.kubernetes.io/exclude: "true"` is honored by k8s-gateway as well as external-dns; adding it blocked cluster-internal DNS from publishing `coder.renner.uno`.
- Cloudflare external-dns filters on the `cloudflare-proxied` annotation, which this Ingress doesn't have — so dropping `exclude` is sufficient to keep the record off Cloudflare while letting k8s-gateway publish it internally.
## Test plan
- [ ] `kubectl run curltest --image=curlimages/curl -- curl -sk -o /dev/null -w '%{http_code}' https://coder.renner.uno/api/v2/buildinfo` returns 200 from inside the cluster
k8s-gateway honors `external-dns.alpha.kubernetes.io/exclude: "true"`
as well, so adding it to avoid a Cloudflare record also blocked
cluster-internal DNS from publishing coder.renner.uno. Result: the
pod appeared healthy but `coder.renner.uno` was unreachable in-cluster
(fell through k8s-gateway → upstream → stray Cloudflare record → 504
via cloudflared/Caddy HA).
The Cloudflare external-dns instance already filters on the
`cloudflare-proxied` annotation, which this Ingress doesn't have, so
dropping `exclude` is sufficient: no public record, and k8s-gateway
resumes publishing for cluster-internal resolution.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
external-dns.alpha.kubernetes.io/exclude: "true"is honored by k8s-gateway as well as external-dns; adding it blocked cluster-internal DNS from publishingcoder.renner.uno.cloudflare-proxiedannotation, which this Ingress doesn't have — so droppingexcludeis sufficient to keep the record off Cloudflare while letting k8s-gateway publish it internally.Test plan
kubectl run curltest --image=curlimages/curl -- curl -sk -o /dev/null -w '%{http_code}' https://coder.renner.uno/api/v2/buildinforeturns 200 from inside the clusterclaude-bot referenced this pull request2026-10-11 19:30:09 +00:00